With an increase of on-line services provided through internet, authentication of users has become a very significant factor. For purchase of goods through internet shopping sites or financial banking services provided for by banking sites, for instance, input of the user information (ID and password) to the corresponding site is mandatory.
In addition to the services resulting in financial transactions such as banking and shopping services, user authentication has become prevalent in terms of protecting personal information exposed to the servers of sites necessitating simple exchanges of the users' information.
The conventional way of authenticating the users is generally performed in the following manners. A client first inputs his/her own password to a server, which in turn authenticates the client only when the inputted password is identical to the stored and registered password. Another way of authenticating users is to utilize bio-information of the users such as fingerprint.
As a remedy of consolidating security of the user authentication system using passwords, a one-time password (OTP) is available. It is a method of blocking the repeated use of the ever-used password based on the characteristics that the calculation of hash function is easy in forward order but is difficult in reverse order. This method can serve to eliminate the danger of false authentication using a password exposed to the network in the course of being transferred to a server.
FIG. 1 is a schematic diagram illustrating the mechanism of authenticating a user by using the one-time available password. As shown in FIG. 1, the user decides a password in the preparing step, and registers in a server after performing a hash function on the password appropriate times (e.g., 100 times). In other words, when assuming the hash function to be “h( )”, the calculation is made as follows.P100=h[h( . . . h(password) . . . )]←100 times→Here, the P100 represents that the hash function is performed 100 times on the password. The server registers P100 which is a result of performing the hash function, and that P100 was performed the hash function 100 times [step 11].
When actually logging in subsequently, the server requests the P99 (performing the hash function on the password 99 times), and the user calculates the P99 in its own computer. In other words, if the user inputs a password to his/her own PC, the computer calculates the P99 and transfers the calculated P99 to a server [step 21]. The server receives and performs once the hash function of the P99 to obtain P100. The server then determines whether the obtained P100 coincides with the P100 stored in the server (P100=h (P99)) [step 13]
If the authentication is successfully completed, the server renews the P100 and stores the P99 [step 15]. In a next log-in, the server requests P98, and the same procedure is repeated.
According to the user authentication of the OTP manner as shown in FIG. 1, even if the P99 is exposed by a communication tapper, the tapper is unable to know the P98. Therefore, the user can transmit his/her password with no concern.
Meanwhile, the user authentication using the fingerprint is a method of authenticating the users by transmitting the fingerprint data for the purpose of authentication from a user's PC to a network, and comparing the data with those stored in the server. The fingerprint data are normally transferred in the encrypted form.
Under the OTP user authentication method, a server registration procedure must be undergone again for authentication of a user once after the user transferred a P1. Further, the user needs to call the hash function several times, thereby consuming a considerable time for authentication.
The user authentication using fingerprint also poses the following problems. First, an exposure of a password does not affect alternation of the password, but an exposure of fingerprint data constrains alternation of the fingerprint data in many aspects (e.g., the number of fingerprint or the fingerprint of a finger convenient for authentication, etc.). Second, the bio-information including the fingerprint slightly differs in each input, and therefore, the OTP algorithm described above (which can eliminate the danger of false authentication using the password exposed in the network) cannot be used. Third, the fingerprint data are normally transferred in the encrypted form, and hence, an exposure of the encrypted fingerprint data is apt to be led to a false authentication in its entirety.